samples/landlock: Add capability and namespace restriction support

Extend the sandboxer sample to demonstrate the new Landlock capability
and namespace restriction features.  LL_CAP takes a colon-delimited list
of allowed capabilities.  Numeric values are always accepted; when
libcap development files are available, use cap_from_name(3) to accept
names too.  Builds without libcap warn when capability settings are
used.  This keeps the sample buildable without optional development
files.  LL_NS takes a colon-delimited list of allowed namespace types by
short name.  Add best-effort degradation for older kernels that predate
the LANDLOCK_PERMISSION_* features.

Allow creating user and UTS namespaces but deny network namespaces, as
an unprivileged user.  The first command succeeds and sets the hostname
inside the new UTS namespace; the second is denied because the network
namespace type is not allowed:

  LL_FS_RO=/ LL_FS_RW=/proc LL_NS="user:uts" \
    ./sandboxer /bin/sh -c \
    "unshare --user --uts --map-root-user hostname sandbox \
    && ! unshare --user --net true"

Allow only user namespace creation and CAP_SYS_CHROOT, denying all other
capabilities and namespace types.  An unprivileged process creates a
user namespace, which requires no capability, and calls chroot inside it
using the CAP_SYS_CHROOT granted within that namespace:

  LL_FS_RO=/ LL_FS_RW="" LL_NS="user" LL_CAP="cap_sys_chroot" \
    ./sandboxer /bin/sh -c \
    "unshare --user --keep-caps chroot / true"

Allow user namespace creation but deny network namespaces, and quiet the
network-namespace denials with LL_NS_QUIET so the denied creation is not
audit logged.  The negated second command makes the whole line succeed:

  LL_FS_RO=/ LL_FS_RW=/proc LL_NS="user" LL_NS_QUIET="net" \
    ./sandboxer /bin/sh -c \
    "unshare --user --map-root-user true && ! unshare --user --net true"

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20261014082718.1435842-8-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

0 files changed, 0 insertions, 0 deletions